Microsoft has released version 5.2 of its Enhanced Mitigation Experience Toolkit (EMET), which offers increased security protections in several areas, including code hijacking attacks and improvements in Attack Surface Reduction (ASR) mitigation.
For those unfamiliar with the tool, as Microsoft explains it, EMET “anticipates the most common actions and techniques adversaries might use” in compromising a computer, and helps protect systems against new and undiscovered threats and exploits by diverting, terminating, blocking, and invalidating those actions and techniques.
According to Microsoft, EMET 5.2’s native DLLs have been compiled with Control Flow Guard (CFG), a new feature introduced in Visual Studio 2015 that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects, Microsoft said.
Because Microsoft strongly encourages 3rd party developers to recompile their application to take advantage of the latest security technology, EMET has been compiled with CFG. More information on CFG is available in a blog post from the this Visual C++ Team.
Additionally, the configuration for the ASR mitigation in EMET 5.2 has been improved to stop attempts to run the VBScript extension when loaded in the Internet Explorer’s Internet Zone. This would mitigate the exploitation technique known as “VBScript God Mode” observed in recent attacks, Microsoft explained.
Finally, EMET 5.2 fully supports alerting and reporting from Modern Internet Explorer, or Desktop IE with Enhanced Protected Mode enabled.
While EMET does add an extra layer of security against various attacks, the toolkit has been bypassed or disarmed on several occasions by researchers in the past.
In late September 2014, researchers at presented a method that can be used to disarm EMET 5.0. Not long after, in Nov. 2014, researcher René Freingruber found “numerous methods to get around the basic protection mechanisms of EMET.”
Additionally, while the tool is stable overall, users should be cautious when using it, as Microsoft has warned that some security mitigation technologies may break applications. The software giant strongly suggests thoroughly testing EMET in all target use scenarios before rolling it out to a production environment.
“There is no one tool capable of preventing all attacks. EMET is designed to make it more difficult, expensive and time consuming, and therefore less likely, for attackers to exploit a system,” a Microsoft spokesperson previously told SecurityWeek.
EMET 5.2 can be downloaded from microsoft.com/emet.

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- Watch Now: Threat Detection and Incident Response Virtual Summit
- Registration Now Open: 2023 ICS Cybersecurity Conference | Atlanta
- NetRise Adds $8 Million in Funding to Grow XIoT Security Platform
- Virtual Event Today: Zero Trust Strategies Summit
- Virtual Event Tomorrow: Zero Trust Strategies Summit
- Watch: How to Build Resilience Against Emerging Cyber Threats
- Video: How to Build Resilience Against Emerging Cyber Threats
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
Latest News
- Consolidate Vendors and Products for Better Security
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
